Bump ws and guacamole-lite in /vdi-vm/images/guacamole-lite

[dependabot]

Bumps ws to 8.21.1 and updates ancestor dependency guacamole-lite. These dependencies need to be updated together.

Updates ws from 1.1.5 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Updates guacamole-lite from 0.6.3 to 1.2.0

Release notes

Sourced from guacamole-lite's releases.

1.2.0

This release introduces dynamic routing to multiple guacd instances and comprehensive session join tracking. These features enable guacamole-lite to be used in large, distributed environments with horizontal scaling. Thanks to @​ujwal-setlur for this awesome PR vadimpronin/guacamole-lite#70

New Features

• Dynamic Multi-Host guacd Routing: guacamole-lite is no longer tied to a single guacd instance.

  • Per-Connection Routing: The encrypted token can now include guacdHost and guacdPort to route a new connection to any guacd instance on-the-fly.
  • Automatic Join Routing: When a user joins an existing session, the server automatically looks up the session's location and routes the join request to the correct guacd instance, enabling seamless cross-instance session sharing.
  • Backward Compatibility: If routing information is not provided in the token, the server uses the default guacd options, ensuring existing setups continue to work without modification.

• Comprehensive Session Join Tracking:

  • Session Registry: The server now tracks all active sessions, including which guacd instance they are running on and who is connected. This registry can be an in-memory Map (default) or a shared external store (like Redis) for multi-server deployments.
  • Complete Audit Trail: For each active session, the registry maintains a list of all joined connections, including their connection ID, the time they joined, and their specific settings (e.g., read-only mode).
  • Smart Session Cleanup: When a user who has joined a session disconnects, only their connection is removed from the registry, leaving the primary session and other joined users unaffected.

Breaking Changes

• None: This release is fully backward-compatible with previous versions. All existing constructor patterns and token structures will continue to work as before.

Features & Enhancements

• Session Registry Integration: A new sessionRegistry callback allows developers to provide a shared, Map-like object (e.g., backed by Redis) to manage session state across multiple horizontally-scaled guacamole-lite instances.
• Enhanced guacd Error Handling: guacd connection errors (e.g., ECONNREFUSED, ETIMEDOUT) are now handled gracefully within the client connection. Instead of crashing the server, specific Guacamole error codes (like SERVICE_UNAVAILABLE) are sent to the web client.
• Enhanced Test Environment: The end-to-end testing environment in test-guac/ has been completely overhauled to demonstrate the new scaling features:
  • Multi-guacd Simulation: Now runs three separate guacd containers (guacd-1, guacd-2, guacd-3) to test dynamic routing.
  • Admin Dashboard: A new admin web interface is available to visualize the session registry in real-time, showing active sessions, their guacd locations, and join tracking.
  • Updated Client UI: The test client now includes a dropdown to select a target guacd instance for new connections.

Bug Fixes

• Unhandled Server Crash on guacd Error: Fixed a critical bug where a connection error from guacd would cause an unhandled exception and crash the entire Node.js process. Errors are now caught per-connection, logged, and reported

... (truncated)

Changelog

Sourced from guacamole-lite's changelog.

[1.2.0]

This release introduces dynamic routing to multiple guacd instances and comprehensive session join tracking. These features enable guacamole-lite to be used in large, distributed environments with horizontal scaling.

New Features

• Dynamic Multi-Host guacd Routing: guacamole-lite is no longer tied to a single guacd instance.

  • Per-Connection Routing: The encrypted token can now include guacdHost and guacdPort to route a new connection to any guacd instance on-the-fly.
  • Automatic Join Routing: When a user joins an existing session, the server automatically looks up the session's location and routes the join request to the correct guacd instance, enabling seamless cross-instance session sharing.
  • Backward Compatibility: If routing information is not provided in the token, the server uses the default guacd options, ensuring existing setups continue to work without modification.

• Comprehensive Session Join Tracking:

  • Session Registry: The server now tracks all active sessions, including which guacd instance they are running on and who is connected. This registry can be an in-memory Map (default) or a shared external store (like Redis) for multi-server deployments.
  • Complete Audit Trail: For each active session, the registry maintains a list of all joined connections, including their connection ID, the time they joined, and their specific settings (e.g., read-only mode).
  • Smart Session Cleanup: When a user who has joined a session disconnects, only their connection is removed from the registry, leaving the primary session and other joined users unaffected.

Breaking Changes

• None: This release is fully backward-compatible with previous versions. All existing constructor patterns and token structures will continue to work as before.

Features & Enhancements

• Session Registry Integration: A new sessionRegistry callback allows developers to provide a shared, Map-like object (e.g., backed by Redis) to manage session state across multiple horizontally-scaled guacamole-lite instances.
• Enhanced guacd Error Handling: guacd connection errors (e.g., ECONNREFUSED, ETIMEDOUT) are now handled gracefully within the client connection. Instead of crashing the server, specific Guacamole error codes (like SERVICE_UNAVAILABLE) are sent to the web client.
• Enhanced Test Environment: The end-to-end testing environment in test-guac/ has been completely overhauled to demonstrate the new scaling features:
  • Multi-guacd Simulation: Now runs three separate guacd containers (guacd-1, guacd-2, guacd-3) to test dynamic routing.
  • Admin Dashboard: A new admin web interface is available to visualize the session registry in real-time, showing active sessions, their guacd locations, and join tracking.
  • Updated Client UI: The test client now includes a dropdown to select a target guacd instance for new connections.

Bug Fixes

• Unhandled Server Crash on guacd Error: Fixed a critical bug where a connection error from guacd would cause an unhandled exception and crash the entire Node.js process. Errors are now caught per-connection, logged, and reported

... (truncated)

Commits

• d60ad34 1.2.0
• 7f3d5fd Update README.md to include default guacd instance configuration and dynamic ...
• d98610a Update CHANGELOG.md for version 1.2.0: Add dynamic multi-host guacd routing a...
• 5111717 Update the docs to reflect multi-guacd setup
• e44c956 Merge pull request #70 from ujwal-setlur/master
• b28e029 1.1.0
• ab10abb Update of documentation to reflect multi-guacd setups
• ede5a80 async support for session registry backed by Redis
• ab546a4 better error handling when guacd is not available
• 464666a Test coverage
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.